78 lines
3.2 KiB
HCL
78 lines
3.2 KiB
HCL
##############################################################################
|
|
# Deployment Script: Managed Kubernetes cluster (OVHcloud)
|
|
#
|
|
# Thin root calling the provisioner owned "kubernetes" catalog module. The
|
|
# module provisions an OVH Managed Kubernetes (MKS) cluster with one node
|
|
# pool and generates the access credentials: the consumer receives a scoped
|
|
# ServiceAccount kubeconfig with a non expiring token, valid until a
|
|
# credential renewal is requested; day 2 renewal uses a dedicated root
|
|
# kubeconfig. All credential material is written by the
|
|
# module to Vault under the existing path contract; only the Vault path is
|
|
# returned in the provisioning response. The OVH admin certificates are
|
|
# never delivered.
|
|
#
|
|
# No terraform/required_providers and no provider blocks are needed: the
|
|
# catalog module carries its own provider requirements, the cloud provider
|
|
# is configured from the runner environment and the Vault provider file is
|
|
# generated by the provisioner.
|
|
#
|
|
# Placeholders (all filled by the provisioner, never typed by the user):
|
|
# - the module source placeholder resolves to the kubernetes module of the
|
|
# cloudProvider sent in the request headers
|
|
# - 313b7271-0173-427a-a1c5-8495234fb2b6 is the scriptTriggerId of the request
|
|
# - development-test is the value of the cloudAccount header
|
|
# - a1e24f5f-8cc3-4882-9be8-b12f85fe961d is the value of the requesterUniqueId header
|
|
##############################################################################
|
|
|
|
module "kubernetes" {
|
|
source = "git::http://gitea-http.dataprovider01.svc.cluster.local:3000/gitops_test/tfmodules.git//kubernetes/ovh?ref=3.2.0-F-feature-simpl-31671.660.aaad53cc"
|
|
deployment_id = "313b7271-0173-427a-a1c5-8495234fb2b6"
|
|
cloud_account = "development-test"
|
|
requester_unique_id = "a1e24f5f-8cc3-4882-9be8-b12f85fe961d"
|
|
|
|
# OVHcloud region. Must support Managed Kubernetes (OVH API:
|
|
# /cloud/project/{id}/capabilities/kube/regions). The project itself is not
|
|
# set here: the provider resolves it from the cloud account configuration
|
|
# of the environment (OVH_CLOUD_PROJECT_SERVICE in the runner environment).
|
|
region = "SBG5"
|
|
|
|
# Cluster: version must be one of the versions currently supported by OVH
|
|
# MKS; update_policy is ALWAYS_UPDATE, MINIMAL_DOWNTIME or NEVER_UPDATE.
|
|
k8s_version = "1.32"
|
|
k8s_update_policy = "ALWAYS_UPDATE"
|
|
|
|
# Node pool sizing. Set nodepool_autoscale = true to enable the OVH managed
|
|
# cluster autoscaler between min and max nodes.
|
|
nodepool_flavor = "b3-8"
|
|
nodepool_desired_nodes = 3
|
|
nodepool_min_nodes = 1
|
|
nodepool_max_nodes = 5
|
|
nodepool_autoscale = false
|
|
|
|
# Optional private mode: attach the worker nodes to an existing vRack
|
|
# network of the same project. Leave unset for a public cluster.
|
|
# private_network_id = "<openstack network id>"
|
|
# nodes_subnet_id = "<subnet id>"
|
|
# gateway_ip = "<vrack gateway ip>"
|
|
}
|
|
|
|
output "cluster_id" {
|
|
value = module.kubernetes.cluster_id
|
|
}
|
|
|
|
output "cluster_name" {
|
|
value = module.kubernetes.cluster_name
|
|
}
|
|
|
|
output "cluster_url" {
|
|
value = module.kubernetes.cluster_url
|
|
}
|
|
|
|
output "cluster_version" {
|
|
value = module.kubernetes.cluster_version
|
|
}
|
|
|
|
output "credentials_ref" {
|
|
value = module.kubernetes.credentials_ref
|
|
}
|